Security

Last updated November 10, 2026

Reporting a vulnerability

If you believe you've found a security issue in OMNIVAREN, please email support@omnivaren.com with the steps to reproduce it and the version you're running (shown in Systems › Updates). Please don't publish details until a fix is available. We aim to acknowledge reports within 3 business days. Good-faith research on your own installation is welcome; please don't test against systems you don't own.

Supported versions

Security fixes are provided for the current release and the previous minor release.

How releases are protected

• Signed. Every release is signed with the publisher's offline Ed25519 key. The first signed install pins that key, and afterwards OMNIVAREN refuses unsigned updates and updates signed by any other key.
• Verified. Every file in a release is listed with its SHA-256 hash in a signed manifest, which the installer checks before changing anything.
• Pinned dependencies. Every library is an exact version, verified by hash, and bundled in the release, so installs don't download code.
• Software bill of materials. Each release includes a CycloneDX SBOM and full third-party license notices.
• Self-Check. OMNIVAREN re-verifies its own code, libraries and web server twice a day and alerts on any change.
• Agents verify too. Windows and Linux agents only accept updates you approve, after checking the publisher's signature themselves.